Artificial intelligence (AI) is profoundly transforming our societies and economies. To harness this potential and manage the risks, the European Union is introducing the first comprehensive legislation on AI, the AI Act, from 1 August 2024.
A few key figures on the AI market
AI has become an essential vector of transformation:
- World market: estimated at 500 billion dollars by 2028 (Source: Statista).
- Growth: The market is expected to grow by 37% each year from 2024 to 2030 (Source: Hostinger).
- Public perception: 51% of French people consider AI to be both a danger and a progress (Source: Cluster 17 and Le Point).
These figures demonstrate the strategic importance of AI and the need for appropriate regulation.
Why regulate artificial intelligence?
- Bias and discrimination: risk that existing prejudices in training data are reproduced and amplified, leading to discriminatory decisions.
- Privacy protection: risks linked to profiling, unauthorized access to personal data, and the Cambridge Analytica incident.
- Manipulation of information: problem of deepfakes and the spread of fake news by bots.
- Impact on employment: transformation of the labor market with the creation of new opportunities, but also the potential for inequalities.
- Lack of transparency: opaque functioning of AI systems, often likened to “black boxes.”
- Security and safety: risks of misuse or malfunction that could lead to accidents or endanger critical infrastructure.
AI Act: how the law regulates AI systems
The AI Act is the world's first general legislation to regulate the development, marketing and use of artificial intelligence systems. Its key points include:
Classification of AI systems by risk
- Unacceptable risks: systems banned since 2 February (e.g., social scoring systems, real‑time emotion detection in the workplace, real‑time facial recognition in public spaces for profiling purposes).
- High risk: systems requiring strict regulation (e.g., remote biometric identification, surveillance systems for critical infrastructures).
- Risk specific to transparency: systems requiring transparency safeguards (e.g., facial recognition systems, recommendation systems).
- Minimal risk: systems such as chatbots or anti‑spam filters, for which the adoption of codes of good practice is encouraged.
Players in the AI value chain
The AI Act applies to all actors involved in the lifecycle of AI systems, including:
- Suppliers: those who develop and market AI systems.
- Deployers: those who use AI systems in a professional context.
- Proxies: those who are located in the European Union and who have received a written mandate from an AI‑services provider. This mandate enables the mandatary to act on behalf of the provider to manage its obligations and procedures.
- Importers: those who are located in the EU and who place on the market an AI system bearing the name or trademark of an enterprise established in a third country.
- Distributors: those who make AI systems available on the EU market.
Obligations of AI players
The obligations of AI players depend on the level of risk associated with their AI systems. High-risk AI systems entail obligations for all players:
For suppliers
Suppliers must identify themselves on the AI system, draw up a declaration of conformity, affix a CE mark, ensure quality management, assess conformity before placing on the market and take corrective action in the event of non-compliance.
For deployers
Deployers have specific responsibilities. In organisational and technical terms, they must implement measures to guarantee the security of the system, ensure effective human control over its use, and rigorously check the quality of input data. In terms of communication, they are responsible for informing employees and data subjects, and must carry out impact assessments on fundamental rights.
For agents
As for agents, they must verify the compliance of high-risk AI systems, keep documents available to the authorities for ten years, cooperate to mitigate risks and comply with registration obligations.
For the importers :
Importers, for their part, are responsible for ensuring the conformity of AI systems before they are placed on the market, and for indicating the identity of the AI system and its documentation. They are also responsible for keeping a copy of the certificate issued by the notified body for ten years.
For distributors
Distributors also have their own obligations. They must meticulously check the conformity of documents, apply a precautionary principle before any distribution, and guarantee appropriate storage and transport conditions.
Penalties for non-compliance
The IA Act lays down strict penalties for non-compliance with obligations, including :
- Prohibited practices: fines that can reach up to 35 million € or 7% of annual turnover.
- Other infringements: sanctions that can go up to 15 million € or 3% of worldwide annual turnover.
- Providing inaccurate information: fines of up to 7 500 000 € or 1% of worldwide annual turnover.
Compliance can be difficult. We need to map the uses of AI, identify the risks and prepare the tools for assessment and compliance.
If you would like to be accompanied by experts in the field on these subjects, contact Cloud Temple